Analysis
-
max time kernel
5s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2024 19:38
Behavioral task
behavioral1
Sample
4f0a7b8523cea2af5411490ec5a94333.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f0a7b8523cea2af5411490ec5a94333.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
4f0a7b8523cea2af5411490ec5a94333.exe
-
Size
666KB
-
MD5
4f0a7b8523cea2af5411490ec5a94333
-
SHA1
291f3a0e32334823c41da2e1013819bd9b133bd4
-
SHA256
e61e016f08831015aa39a818fc430b786f13f3611d269a8a88165c899730a4f7
-
SHA512
62488dd26192fcc487785e09f7493b990d54fba6b97aa1b201f3a746dd0b789e16b98d5bbd3f5e96f7b6b2cb0acc6266b29b558e52612bddbaf6e4c6873eb9bd
-
SSDEEP
12288:5MMpXKb0hNGh1kG0HWnAL7MMpXKb0hNGh1kG0HWnAL+:5MMpXS0hN0V0H7MMpXS0hN0V0H+
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 4f0a7b8523cea2af5411490ec5a94333.exe -
Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 4f0a7b8523cea2af5411490ec5a94333.exe -
Executes dropped EXE 1 IoCs
pid Process 1768 HelpMe.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\A: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\I: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\H: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\J: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\N: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\P: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\Q: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\U: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\B: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\G: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\V: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\W: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\X: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\E: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\K: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\R: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\S: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\T: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\Y: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\Z: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\L: 4f0a7b8523cea2af5411490ec5a94333.exe File opened (read-only) \??\M: 4f0a7b8523cea2af5411490ec5a94333.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF 4f0a7b8523cea2af5411490ec5a94333.exe File opened for modification C:\AUTORUN.INF 4f0a7b8523cea2af5411490ec5a94333.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Drops file in Program Files directory 49 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\da.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\ast.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7zCon.sfx.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\be.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\co.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\he.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\hu.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\an.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\ar.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\ga.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7-zip.chm.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7-zip.dll.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\el.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\gl.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\gu.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7z.exe.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\br.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\hr.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\hy.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7z.dll.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\cs.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\cy.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\en.ttt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\es.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\fr.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\descript.ion.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7z.sfx.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\af.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\ca.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\eo.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\id.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\io.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\bn.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\de.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\et.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\fa.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\az.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\ext.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\fi.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\fur.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\hi.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7zFM.exe.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\bg.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\fy.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\History.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\ba.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\Lang\eu.txt.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7-zip32.dll.exe 4f0a7b8523cea2af5411490ec5a94333.exe File created C:\Program Files\7-Zip\7zG.exe.exe 4f0a7b8523cea2af5411490ec5a94333.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4004 wrote to memory of 1768 4004 4f0a7b8523cea2af5411490ec5a94333.exe 24 PID 4004 wrote to memory of 1768 4004 4f0a7b8523cea2af5411490ec5a94333.exe 24 PID 4004 wrote to memory of 1768 4004 4f0a7b8523cea2af5411490ec5a94333.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f0a7b8523cea2af5411490ec5a94333.exe"C:\Users\Admin\AppData\Local\Temp\4f0a7b8523cea2af5411490ec5a94333.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1768
-